Rewrite of the authentication and authorization system

6 files changed, 484 insertions, 98 deletions

diff --git a/app/Core/Ldap/Client.php b/app/Core/Ldap/Client.php
index a523428c..5d481cd3 100644
--- a/app/Core/Ldap/Client.php
+++ b/app/Core/Ldap/Client.php
@@ -2,6 +2,8 @@
 
 namespace Kanboard\Core\Ldap;
 
+use LogicException;
+
 /**
  * LDAP Client
  *
@@ -11,16 +13,60 @@ namespace Kanboard\Core\Ldap;
 class Client
 {
     /**
+     * LDAP resource
+     *
+     * @access private
+     * @var resource
+     */
+    private $ldap;
+
+    /**
+     * Establish LDAP connection
+     *
+     * @static
+     * @access public
+     * @param  string $username
+     * @param  string $password
+     * @return Client
+     */
+    public static function connect($username = null, $password = null)
+    {
+        $client = new self;
+        $client->open($client->getLdapServer());
+        $username = $username ?: $client->getLdapUsername();
+        $password = $password ?: $client->getLdapPassword();
+
+        if (empty($username) && empty($password)) {
+            $client->useAnonymousAuthentication();
+        } else {
+            $client->authenticate($username, $password);
+        }
+
+        return $client;
+    }
+
+    /**
      * Get server connection
      *
      * @access public
+     * @return resource
+     */
+    public function getConnection()
+    {
+        return $this->ldap;
+    }
+
+    /**
+     * Establish server connection
+     *
+     * @access public
      * @param  string   $server  LDAP server hostname or IP
      * @param  integer  $port    LDAP port
      * @param  boolean  $tls     Start TLS
      * @param  boolean  $verify  Skip SSL certificate verification
-     * @return resource
+     * @return Client
      */
-    public function getConnection($server, $port = LDAP_PORT, $tls = LDAP_START_TLS, $verify = LDAP_SSL_VERIFY)
+    public function open($server, $port = LDAP_PORT, $tls = LDAP_START_TLS, $verify = LDAP_SSL_VERIFY)
     {
         if (! function_exists('ldap_connect')) {
             throw new ClientException('LDAP: The PHP LDAP extension is required');
@@ -30,34 +76,33 @@ class Client
             putenv('LDAPTLS_REQCERT=never');
         }
 
-        $ldap = ldap_connect($server, $port);
+        $this->ldap = ldap_connect($server, $port);
 
-        if ($ldap === false) {
+        if ($this->ldap === false) {
             throw new ClientException('LDAP: Unable to connect to the LDAP server');
         }
 
-        ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
-        ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
-        ldap_set_option($ldap, LDAP_OPT_NETWORK_TIMEOUT, 1);
-        ldap_set_option($ldap, LDAP_OPT_TIMELIMIT, 1);
+        ldap_set_option($this->ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
+        ldap_set_option($this->ldap, LDAP_OPT_REFERRALS, 0);
+        ldap_set_option($this->ldap, LDAP_OPT_NETWORK_TIMEOUT, 1);
+        ldap_set_option($this->ldap, LDAP_OPT_TIMELIMIT, 1);
 
-        if ($tls && ! @ldap_start_tls($ldap)) {
+        if ($tls && ! @ldap_start_tls($this->ldap)) {
             throw new ClientException('LDAP: Unable to start TLS');
         }
 
-        return $ldap;
+        return $this;
     }
 
     /**
      * Anonymous authentication
      *
      * @access public
-     * @param  resource $ldap
      * @return boolean
      */
-    public function useAnonymousAuthentication($ldap)
+    public function useAnonymousAuthentication()
     {
-        if (! ldap_bind($ldap)) {
+        if (! @ldap_bind($this->ldap)) {
             throw new ClientException('Unable to perform anonymous binding');
         }
 
@@ -68,17 +113,53 @@ class Client
      * Authentication with username/password
      *
      * @access public
-     * @param  resource $ldap
-     * @param  string   $username
-     * @param  string   $password
+     * @param  string  $bind_rdn
+     * @param  string  $bind_password
      * @return boolean
      */
-    public function authenticate($ldap, $username, $password)
+    public function authenticate($bind_rdn, $bind_password)
     {
-        if (! ldap_bind($ldap, $username, $password)) {
-            throw new ClientException('Unable to perform anonymous binding');
+        if (! @ldap_bind($this->ldap, $bind_rdn, $bind_password)) {
+            throw new ClientException('LDAP authentication failure for "'.$bind_rdn.'"');
         }
 
         return true;
     }
+
+    /**
+     * Get LDAP server name
+     *
+     * @access public
+     * @return string
+     */
+    public function getLdapServer()
+    {
+        if (! LDAP_SERVER) {
+            throw new LogicException('LDAP server not configured, check the parameter LDAP_SERVER');
+        }
+
+        return LDAP_SERVER;
+    }
+
+    /**
+     * Get LDAP username (proxy auth)
+     *
+     * @access public
+     * @return string
+     */
+    public function getLdapUsername()
+    {
+        return LDAP_USERNAME;
+    }
+
+    /**
+     * Get LDAP password (proxy auth)
+     *
+     * @access public
+     * @return string
+     */
+    public function getLdapPassword()
+    {
+        return LDAP_PASSWORD;
+    }
 }
diff --git a/app/Core/Ldap/Entries.php b/app/Core/Ldap/Entries.php
new file mode 100644
index 00000000..b0f78fa4
--- /dev/null
+++ b/app/Core/Ldap/Entries.php
@@ -0,0 +1,63 @@
+<?php
+
+namespace Kanboard\Core\Ldap;
+
+/**
+ * LDAP Entries
+ *
+ * @package ldap
+ * @author  Frederic Guillot
+ */
+class Entries
+{
+    /**
+     * LDAP entries
+     *
+     * @access private
+     * @var array
+     */
+    private $entries = array();
+
+    /**
+     * Constructor
+     *
+     * @access public
+     * @param  array $entries
+     */
+    public function __construct(array $entries)
+    {
+        $this->entries = $entries;
+    }
+
+    /**
+     * Get all entries
+     *
+     * @access public
+     * @return []Entry
+     */
+    public function getAll()
+    {
+        $entities = array();
+
+        if (! isset($this->entries['count'])) {
+            return $entities;
+        }
+
+        for ($i = 0; $i < $this->entries['count']; $i++) {
+            $entities[] = new Entry($this->entries[$i]);
+        }
+
+        return $entities;
+    }
+
+    /**
+     * Get first entry
+     *
+     * @access public
+     * @return Entry
+     */
+    public function getFirstEntry()
+    {
+        return new Entry(isset($this->entries[0]) ? $this->entries[0] : array());
+    }
+}
diff --git a/app/Core/Ldap/Entry.php b/app/Core/Ldap/Entry.php
new file mode 100644
index 00000000..e67dd625
--- /dev/null
+++ b/app/Core/Ldap/Entry.php
@@ -0,0 +1,91 @@
+<?php
+
+namespace Kanboard\Core\Ldap;
+
+/**
+ * LDAP Entry
+ *
+ * @package ldap
+ * @author  Frederic Guillot
+ */
+class Entry
+{
+    /**
+     * LDAP entry
+     *
+     * @access private
+     * @var array
+     */
+    private $entry = array();
+
+    /**
+     * Constructor
+     *
+     * @access public
+     * @param  array $entry
+     */
+    public function __construct(array $entry)
+    {
+        $this->entry = $entry;
+    }
+
+    /**
+     * Get all attribute values
+     *
+     * @access public
+     * @param  string  $attribute
+     * @return string[]
+     */
+    public function getAll($attribute)
+    {
+        $attributes = array();
+
+        if (! isset($this->entry[$attribute]['count'])) {
+            return $attributes;
+        }
+
+        for ($i = 0; $i < $this->entry[$attribute]['count']; $i++) {
+            $attributes[] = $this->entry[$attribute][$i];
+        }
+
+        return $attributes;
+    }
+
+    /**
+     * Get first attribute value
+     *
+     * @access public
+     * @param  string  $attribute
+     * @param  string  $default
+     * @return string
+     */
+    public function getFirstValue($attribute, $default = '')
+    {
+        return isset($this->entry[$attribute][0]) ? $this->entry[$attribute][0] : $default;
+    }
+
+    /**
+     * Get entry distinguished name
+     *
+     * @access public
+     * @return string
+     */
+    public function getDn()
+    {
+        return isset($this->entry['dn']) ? $this->entry['dn'] : '';
+    }
+
+    /**
+     * Return true if the given value exists in attribute list
+     *
+     * @access public
+     * @param  string  $attribute
+     * @param  string  $value
+     * @return boolean
+     */
+    public function hasValue($attribute, $value)
+    {
+        $attributes = $this->getAll($attribute);
+        return in_array($value, $attributes);
+    }
+}
diff --git a/app/Core/Ldap/Group.php b/app/Core/Ldap/Group.php
new file mode 100644
index 00000000..e11e8ecd
--- /dev/null
+++ b/app/Core/Ldap/Group.php
@@ -0,0 +1,130 @@
+<?php
+
+namespace Kanboard\Core\Ldap;
+
+use LogicException;
+use Kanboard\Group\LdapGroupProvider;
+
+/**
+ * LDAP Group Finder
+ *
+ * @package ldap
+ * @author  Frederic Guillot
+ */
+class Group
+{
+    /**
+     * Query
+     *
+     * @access private
+     * @var Query
+     */
+    private $query;
+
+    /**
+     * Constructor
+     *
+     * @access public
+     * @param  Query   $query
+     */
+    public function __construct(Query $query)
+    {
+        $this->query = $query;
+    }
+
+    /**
+     * Get groups
+     *
+     * @static
+     * @access public
+     * @param  Client    $client
+     * @param  string    $query
+     * @return array
+     */
+    public static function getGroups(Client $client, $query)
+    {
+        $self = new self(new Query($client));
+        return $self->find($query);
+    }
+
+    /**
+     * Find groups
+     *
+     * @access public
+     * @param  string    $query
+     * @return array
+     */
+    public function find($query)
+    {
+        $this->query->execute($this->getBasDn(), $query, $this->getAttributes());
+        $groups = array();
+
+        if ($this->query->hasResult()) {
+            $groups = $this->build();
+        }
+
+        return $groups;
+    }
+
+    /**
+     * Build groups list
+     *
+     * @access protected
+     * @return array
+     */
+    protected function build()
+    {
+        $groups = array();
+
+        foreach ($this->query->getEntries()->getAll() as $entry) {
+            $groups[] = new LdapGroupProvider($entry->getDn(), $entry->getFirstValue($this->getAttributeName()));
+        }
+
+        return $groups;
+    }
+
+    /**
+     * Ge the list of attributes to fetch when reading the LDAP group entry
+     *
+     * Must returns array with index that start at 0 otherwise ldap_search returns a warning "Array initialization wrong"
+     *
+     * @access public
+     * @return array
+     */
+    public function getAttributes()
+    {
+        return array_values(array_filter(array(
+            $this->getAttributeName(),
+        )));
+    }
+
+    /**
+     * Get LDAP group name attribute
+     *
+     * @access public
+     * @return string
+     */
+    public function getAttributeName()
+    {
+        if (! LDAP_GROUP_ATTRIBUTE_NAME) {
+            throw new LogicException('LDAP full name attribute empty, check the parameter LDAP_GROUP_ATTRIBUTE_NAME');
+        }
+
+        return LDAP_GROUP_ATTRIBUTE_NAME;
+    }
+
+    /**
+     * Get LDAP group base DN
+     *
+     * @access public
+     * @return string
+     */
+    public function getBasDn()
+    {
+        if (! LDAP_GROUP_BASE_DN) {
+            throw new LogicException('LDAP group base DN empty, check the parameter LDAP_GROUP_BASE_DN');
+        }
+
+        return LDAP_GROUP_BASE_DN;
+    }
+}
diff --git a/app/Core/Ldap/Query.php b/app/Core/Ldap/Query.php
index 1c34fa10..6ca4bc96 100644
--- a/app/Core/Ldap/Query.php
+++ b/app/Core/Ldap/Query.php
@@ -11,6 +11,14 @@ namespace Kanboard\Core\Ldap;
 class Query
 {
     /**
+     * LDAP client
+     *
+     * @access private
+     * @var Client
+     */
+    private $client = null;
+
+    /**
      * Query result
      *
      * @access private
@@ -22,31 +30,30 @@ class Query
      * Constructor
      *
      * @access public
-     * @param  array  $entries
+     * @param  Client $client
      */
-    public function __construct(array $entries = array())
+    public function __construct(Client $client)
     {
-        $this->entries = $entries;
+        $this->client = $client;
     }
 
     /**
      * Execute query
      *
      * @access public
-     * @param  resource  $ldap
      * @param  string    $baseDn
      * @param  string    $filter
      * @param  array     $attributes
      * @return Query
      */
-    public function execute($ldap, $baseDn, $filter, array $attributes)
+    public function execute($baseDn, $filter, array $attributes)
     {
-        $sr = ldap_search($ldap, $baseDn, $filter, $attributes);
+        $sr = ldap_search($this->client->getConnection(), $baseDn, $filter, $attributes);
         if ($sr === false) {
             return $this;
         }
 
-        $entries = ldap_get_entries($ldap, $sr);
+        $entries = ldap_get_entries($this->client->getConnection(), $sr);
         if ($entries === false || count($entries) === 0 || $entries['count'] == 0) {
             return $this;
         }
@@ -68,28 +75,13 @@ class Query
     }
 
     /**
-     * Return subset of entries
-     *
-     * @access public
-     * @param  string   $key
-     * @param  mixed    $default
-     * @return array
-     */
-    public function getAttribute($key, $default = null)
-    {
-        return isset($this->entries[0][$key]) ? $this->entries[0][$key] : $default;
-    }
-
-    /**
-     * Return one entry from a list of entries
+     * Get LDAP Entries
      *
      * @access public
-     * @param  string   $key         Key
-     * @param  string   $default     Default value if key not set in entry
-     * @return string
+     * @return Entities
      */
-    public function getAttributeValue($key, $default = '')
+    public function getEntries()
     {
-        return isset($this->entries[0][$key][0]) ? $this->entries[0][$key][0] : $default;
+        return new Entries($this->entries);
     }
 }
diff --git a/app/Core/Ldap/User.php b/app/Core/Ldap/User.php
index e44a4dda..ab8d7296 100644
--- a/app/Core/Ldap/User.php
+++ b/app/Core/Ldap/User.php
@@ -2,8 +2,12 @@
 
 namespace Kanboard\Core\Ldap;
 
+use LogicException;
+use Kanboard\Core\Security\Role;
+use Kanboard\User\LdapUserProvider;
+
 /**
- * LDAP User
+ * LDAP User Finder
  *
  * @package ldap
  * @author  Frederic Guillot
@@ -24,72 +28,70 @@ class User
      * @access public
      * @param  Query   $query
      */
-    public function __construct(Query $query = null)
+    public function __construct(Query $query)
     {
-        $this->query = $query ?: new Query;
+        $this->query = $query;
     }
 
     /**
-     * Get user profile
+     * Get user profile (helper)
      *
+     * @static
      * @access public
-     * @param  resource  $ldap
-     * @param  string    $baseDn
+     * @param  Client    $client
      * @param  string    $query
      * @return array
      */
-    public function getProfile($ldap, $baseDn, $query)
+    public static function getUser(Client $client, $query)
     {
-        $this->query->execute($ldap, $baseDn, $query, $this->getAttributes());
-        $profile = array();
-
-        if ($this->query->hasResult()) {
-            $profile = $this->prepareProfile();
-        }
-
-        return $profile;
+        $self = new self(new Query($client));
+        return $self->find($query);
     }
 
     /**
-     * Build user profile
+     * Find user
      *
-     * @access private
-     * @return boolean|array
+     * @access public
+     * @param  string    $query
+     * @return null|LdapUserProvider
      */
-    private function prepareProfile()
+    public function find($query)
     {
-        return array(
-            'ldap_id' => $this->query->getAttribute('dn', ''),
-            'username' => $this->query->getAttributeValue($this->getAttributeUsername()),
-            'name' => $this->query->getAttributeValue($this->getAttributeName()),
-            'email' => $this->query->getAttributeValue($this->getAttributeEmail()),
-            'is_admin' => (int) $this->isMemberOf($this->query->getAttribute($this->getAttributeGroup(), array()), $this->getGroupAdminDn()),
-            'is_project_admin' => (int) $this->isMemberOf($this->query->getAttribute($this->getAttributeGroup(), array()), $this->getGroupProjectAdminDn()),
-            'is_ldap_user' => 1,
-        );
+        $this->query->execute($this->getBasDn(), $query, $this->getAttributes());
+        $user = null;
+
+        if ($this->query->hasResult()) {
+            $user = $this->build();
+        }
+
+        return $user;
     }
 
     /**
-     * Check group membership
+     * Build user profile
      *
-     * @access public
-     * @param  array   $group_entries
-     * @param  string  $group_dn
-     * @return boolean
+     * @access protected
+     * @return LdapUserProvider
      */
-    public function isMemberOf(array $group_entries, $group_dn)
+    protected function build()
     {
-        if (! isset($group_entries['count']) || empty($group_dn)) {
-            return false;
-        }
+        $entry = $this->query->getEntries()->getFirstEntry();
+        $role = Role::APP_USER;
 
-        for ($i = 0; $i < $group_entries['count']; $i++) {
-            if ($group_entries[$i] === $group_dn) {
-                return true;
-            }
+        if ($entry->hasValue($this->getAttributeGroup(), $this->getGroupAdminDn())) {
+            $role = Role::APP_ADMIN;
+        } elseif ($entry->hasValue($this->getAttributeGroup(), $this->getGroupManagerDn())) {
+            $role = Role::APP_MANAGER;
         }
 
-        return false;
+        return new LdapUserProvider(
+            $entry->getDn(),
+            $entry->getFirstValue($this->getAttributeUsername()),
+            $entry->getFirstValue($this->getAttributeName()),
+            $entry->getFirstValue($this->getAttributeEmail()),
+            $role,
+            $entry->getAll($this->getAttributeGroup())
+        );
     }
 
     /**
@@ -118,29 +120,41 @@ class User
      */
     public function getAttributeUsername()
     {
-        return LDAP_ACCOUNT_ID;
+        if (! LDAP_USER_ATTRIBUTE_USERNAME) {
+            throw new LogicException('LDAP username attribute empty, check the parameter LDAP_USER_ATTRIBUTE_USERNAME');
+        }
+
+        return LDAP_USER_ATTRIBUTE_USERNAME;
     }
 
     /**
-     * Get LDAP account email attribute
+     * Get LDAP user name attribute
      *
      * @access public
      * @return string
      */
-    public function getAttributeEmail()
+    public function getAttributeName()
     {
-        return LDAP_ACCOUNT_EMAIL;
+        if (! LDAP_USER_ATTRIBUTE_FULLNAME) {
+            throw new LogicException('LDAP full name attribute empty, check the parameter LDAP_USER_ATTRIBUTE_FULLNAME');
+        }
+
+        return LDAP_USER_ATTRIBUTE_FULLNAME;
     }
 
     /**
-     * Get LDAP account name attribute
+     * Get LDAP account email attribute
      *
      * @access public
      * @return string
      */
-    public function getAttributeName()
+    public function getAttributeEmail()
     {
-        return LDAP_ACCOUNT_FULLNAME;
+        if (! LDAP_USER_ATTRIBUTE_EMAIL) {
+            throw new LogicException('LDAP email attribute empty, check the parameter LDAP_USER_ATTRIBUTE_EMAIL');
+        }
+
+        return LDAP_USER_ATTRIBUTE_EMAIL;
     }
 
     /**
@@ -151,7 +165,7 @@ class User
      */
     public function getAttributeGroup()
     {
-        return LDAP_ACCOUNT_MEMBEROF;
+        return LDAP_USER_ATTRIBUTE_GROUPS;
     }
 
     /**
@@ -166,13 +180,28 @@ class User
     }
 
     /**
-     * Get LDAP project admin group DN
+     * Get LDAP application manager group DN
      *
      * @access public
      * @return string
      */
-    public function getGroupProjectAdminDn()
+    public function getGroupManagerDn()
     {
-        return LDAP_GROUP_PROJECT_ADMIN_DN;
+        return LDAP_GROUP_MANAGER_DN;
+    }
+
+    /**
+     * Get LDAP user base DN
+     *
+     * @access public
+     * @return string
+     */
+    public function getBasDn()
+    {
+        if (! LDAP_USER_BASE_DN) {
+            throw new LogicException('LDAP user base DN empty, check the parameter LDAP_USER_BASE_DN');
+        }
+
+        return LDAP_USER_BASE_DN;
     }
 }